Set up Custom Domain for Entra External ID

Yes, this is supported. A custom URL domain such as https://auth.contoso.com can front Microsoft Entra External ID endpoints like https://{tenant-name}.ciamlogin.com/{tenant-id}/oauth2/v2.0/authorize using Azure Front Door, and Cloudflare can sit in front as a WAF.

Below is a step‑by‑step outline based on the documented flow and your components (External ID + Azure Front Door + Cloudflare).

1. Prepare and verify the custom domain in the external tenant
2. Sign in to the Microsoft Entra admin center as a Domain Name Administrator.
3. Switch to the external tenant.
4. Go to Identity > Settings > Domain names > Custom domain names.
5. Add the custom domain name you want to use, for example auth.contoso.com.
6. At the DNS provider, create the required TXT (or MX) record to verify ownership. The TXT record must be on the exact hostname (for example, auth for auth.contoso.com), not on the root (@).
7. After verification completes, delete the TXT record as recommended.
8. If multiple subdomains will be used (for example, login.contoso.com and account.contoso.com), verify each subdomain individually.
9. Associate the verified domain with a custom URL domain
10. In the same external tenant, navigate to Entra ID > Domain names > Custom URL domains.
11. Select Add custom url domain.
12. Choose the verified custom domain (for example, auth.contoso.com).
13. Select Add.

This associates the DNS name with External ID so it can be used as an authentication endpoint host.

3. Configure Azure Front Door for the custom URL domain
4. In Azure Front Door, add a custom domain with the hostname you want to expose, for example auth.contoso.com.
5. For DNS management, choose All other DNS services.
6. Enter the custom domain (auth.contoso.com) and add it.
7. Under Validation state, open the Pending pane and copy the TXT record details.
8. In the DNS provider for contoso.com, create the TXT record:
   • Name: the subdomain part of _dnsauth.contoso.com (for example, _dnsauth).
   • Type: TXT.
   • Value: the value provided by Front Door.
9. Wait until the Validation state changes from Pending to Approved in Front Door.
10. Under Endpoint association, select Unassociated, choose the Front Door endpoint that fronts External ID, and select the appropriate route (for example, default-route).
11. In Front Door manager, select the endpoint, open default-route, check Enabled route, and Update.

At this point, DNS for the custom hostname must have a CNAME pointing to the Front Door default front-end host (for example, contoso-frontend.azurefd.net), as described in the custom URL domain network flow.

4. Place Cloudflare WAF in front (optional but supported)

If Cloudflare is used as WAF in front of Azure Front Door:

1. Ensure the custom domain (auth.contoso.com) is managed in Cloudflare.
2. In Cloudflare DNS, configure a CNAME for auth.contoso.com that points to the Azure Front Door front-end host.
3. Set Proxy status to Proxied so Cloudflare WAF is active.
4. Enable Cloudflare security controls (DDoS, Bot protection, etc.) as needed.

Note: When a third‑party DNS/WAF like Cloudflare fronts Azure Front Door, Azure Front Door–managed certificates are not auto‑renewed if the CNAME no longer points directly to the Front Door endpoint domain. In that case, follow the documented certificate renewal guidance for Azure Front Door.

5. Update application endpoints to use the custom URL domain

Once the custom URL domain is configured and routed through Front Door (and optionally Cloudflare), update client applications to use the new host instead of *.ciamlogin.com.

For OpenID Connect/OAuth2 endpoints, the patterns become:

• OpenID configuration:
  • https://auth.contoso.com/{tenant-name}/v2.0/.well-known/openid-configuration
• Authorization endpoint:
  • https://auth.contoso.com/{tenant-name}/oauth2/v2.0/authorize
• Token endpoint:
  • https://auth.contoso.com/{tenant-name}/oauth2/v2.0/token

{tenant-name} can be replaced with the tenant ID GUID to remove onmicrosoft.com from URLs, for example:

• https://auth.contoso.com/{tenant-id-guid}/oauth2/v2.0/authorize

If using SAML, the SP metadata URL would look like:

• https://auth.contoso.com/{tenant-name}/Samlp/metadata

Also update any OAuth redirect URIs registered in the identity provider to use the custom domain, for example:

• https://auth.contoso.com/{tenant-id-guid}/oauth2/authresp

6. How to test the configuration
7. DNS resolution test
   • From a client machine, resolve auth.contoso.com and confirm it resolves successfully.
   • Verify that the CNAME chain ultimately points to the Azure Front Door front-end host.
8. OpenID configuration test
   • In a browser or HTTP client, request:
     • https://auth.contoso.com/{tenant-name}/v2.0/.well-known/openid-configuration
   • Confirm a valid JSON OpenID configuration document is returned and that the authorization_endpoint and token_endpoint values use auth.contoso.com.
9. Authorization redirect test
   • Configure a test application to use the authority https://auth.contoso.com/{tenant-name}/v2.0 (or with tenant ID).
   • Initiate a sign‑in from the application.
   • Confirm the browser is redirected to https://auth.contoso.com/.../oauth2/v2.0/authorize and the External ID sign‑in page loads correctly.
10. Token acquisition test
    • Complete the sign‑in and ensure the app successfully receives tokens.
    • Inspect the OpenID configuration and token endpoints to confirm they match the custom domain.
11. WAF/Front Door path test
    • In Cloudflare and Azure Front Door logs, confirm that requests to auth.contoso.com traverse Cloudflare WAF, then Azure Front Door, and finally reach the External ID endpoints.

This sequence uses the supported pattern: custom URL domain in External ID, Azure Front Door as reverse proxy, and optional Cloudflare WAF in front, with applications updated to call the custom domain instead of *.ciamlogin.com.

References:

• Enable custom URL domains for apps in external tenants
• Custom URL domains in external tenants
• Configure Cloudflare with Microsoft Entra External ID